{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24535", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:31:40.820Z", "datePublished": "2026-01-23T14:28:51.072Z", "dateUpdated": "2026-04-28T16:14:48.760Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "automatic-featured-images-from-videos", "product": "Automatic Featured Images from Videos", "vendor": "webdevstudios", "versions": [{"changes": [{"at": "1.2.8", "status": "unaffected"}], "lessThanOrEqual": "1.2.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:56.500Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.</p>"}], "value": "Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:48.760Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/automatic-featured-images-from-videos/vulnerability/wordpress-automatic-featured-images-from-videos-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T19:04:11.510603Z", "id": "CVE-2026-24535", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:15:12.641Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T19:04:11.510603Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T19:03:56.766Z"}}], "cna": {"title": "WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "webdevstudios", "product": "Automatic Featured Images from Videos", "versions": [{"status": "affected", "changes": [{"at": "1.2.8", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.2.7"}], "packageName": "automatic-featured-images-from-videos", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:56.500Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/automatic-featured-images-from-videos/vulnerability/wordpress-automatic-featured-images-from-videos-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:05.722Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24535", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:15:12.641Z", "dateReserved": "2026-01-23T12:31:40.820Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:28:51.072Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Automatic Featured Images from Videos: desde n/a hasta &lt;= 1.2.7."}], "id": "CVE-2026-24535", "lastModified": "2026-04-28T15:16:11.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-23T15:16:09.577", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/automatic-featured-images-from-videos/vulnerability/wordpress-automatic-featured-images-from-videos-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:32:17.108845+00:00", "value": {"mitigation_remediation": ["Apply an update to the Automatic Featured Images from Videos plugin to a version newer than 1.2.7.", "If an update cannot be applied immediately, disable the plugin or block access to its admin URLs for non\u2011administrators using web server configuration directives such as .htaccess rules or firewall rules.", "Continuously monitor WordPress logs and access patterns for any unexpected API calls or administrative actions that may indicate abuse of the vulnerable plugin."], "summary": {"action": "Upgrade", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the webdevstudios Automatic Featured Images from Videos plugin version 1.2.7 or older is vulnerable. The flaw affects the entire plugin codebase, not a specific component, so all users of the plugin on a WordPress site are at risk.", "description_and_impact": "The Automatic Featured Images from Videos plugin for WordPress exposes a missing authorization flaw, identified as CWE-862, that permits unauthenticated users to invoke administrative endpoints intended for privileged users. This broken access control could allow the attacker to alter site content, change settings, or retrieve data that should be restricted, thereby compromising the integrity and confidentiality of the WordPress installation.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. With an EPSS score below 1%, the probability of exploitation is very low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves sending crafted HTTP requests to the plugin\u2019s administrative endpoints without authentication, which an attacker can do from any network location with access to the site\u2019s URL."}}}}, "created": "2026-01-26T11:54:35.974454+00:00", "updated": "2026-04-16T07:45:06.012432+00:00", "vendors": ["webdevstudios", "webdevstudios$PRODUCT$automatic_featured_images_from_videos", "wordpress", "wordpress$PRODUCT$wordpress"]}